CVE-2026-105811

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: AMZN

Description

Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account. This sample solution provides an example Lambda hook and requires separate, manual deployment and additional setup. It is not deployed automatically with QnABot. Customers who have not deployed this optional sample hook are not affected and do not need to take action. To remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105811

Affected Vendors & Products

Vendor	Product	Version / Range
aws	qnabot-on-aws	7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the optional Amazon Q Business Lambda hook sample for QnABot on AWS versions 7.0.0 through 7.4.5. It allows an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account by exploiting a user-controlled key in the Lambda hook.

Detection Guidance

This vulnerability affects only those who manually deployed the optional Amazon Q Business Lambda hook sample in QnABot on AWS versions 7.0.0 through 7.4.5. Check if the Lambda hook sample stack is deployed in your AWS account. Review CloudFormation stacks for q-business-lambda-hook or similar names.

Impact Analysis

If you have deployed the optional Amazon Q Business Lambda hook sample, an attacker could access sensitive data stored in your AWS S3 buckets. Customers who did not deploy this sample are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR, HIPAA, or other compliance requirements. Affected customers should remediate it to maintain compliance.

Mitigation Strategies

Update QnABot on AWS stack to version 7.4.6 or later. Redeploy the Amazon Q Business Lambda hook sample stack after updating. Customers without the optional sample hook are not affected.

Hi! I’m here to help you understand CVE-2026-105811. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70